diff --git a/infra/README.md b/infra/README.md
index 700867c..4d6cda7 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -587,14 +587,11 @@ about 11 MB per response; the server allows 10 per minute per client IP. If one
 
 ### Owner decisions (open)
 
-1. **Backup encryption (security review M-1).** The Drive backups (`kvitt-*.sqlite.gz`, `pictures-*.tar.gz`) are
-   not encrypted (SPEC §8.7), and `rclone.conf` holds a token with the full `drive` scope (read and write to your
-   whole Drive). Should the backups go through an rclone `crypt` remote (two passwords kept in `rclone.conf`,
-   restore through the same remote) and should rclone be re-authorised with the narrower `drive.file` scope? Both
-   change SPEC §8.7 and §10.9. Until you decide, the backup scripts stay as they are.
-2. **Gitea token scope.** Does the workflow's tag push work with `kvitt_cicd` limited to `write:package`? If not,
+Backup encryption (security review M-1) is decided: no rclone `crypt`, the `drive` scope stays (SPEC §8.7, 2026-10-19).
+
+1. **Gitea token scope.** Does the workflow's tag push work with `kvitt_cicd` limited to `write:package`? If not,
    is adding `write:repository` acceptable?
-3. **Kvitt's host name (D-120).** Which name is `<KVITT_PUBLIC_HOST>`? It goes into the release app and
+2. **Kvitt's host name (D-120).** Which name is `<KVITT_PUBLIC_HOST>`? It goes into the release app and
    `docs/HANDOFF.md`.
 
 ### Troubleshooting